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STORAGE DEVICE HAVING FUNCTION a virus. If any of the files is infected, the file is treated 

FOR COPING WITH COMPUTER VIRUS properly. The prior art does not adopt a method of actively 

preventing infection with a virus. There is therefore a 
BACKGROUND OF THE INVENTION problem that files expanded on the disk in the storage device 

1. Field of the Invention 5 are x ^ iafected ^ a vims " . _ 

The present invention relates to a storage device having a Moreover, in the prior art, when it is detected that any of 

function for coping with a computer virus that has the ability files expanded on a disk in a storage device is i infected mth 

to prevent infection with a computer virus and to properly a virus, all the files expanded on the disk are cleared and then 

deal with infection with a computer virus. originalsof the files are installed again. Imposes >a problem 

„ + 10 that a user is obliged to incur an enormous work load. 

In recent years, computer systems using computer pro- , 

grams have prevailed in enterprises, households, and the In the prior art, a file judged to be infected with a virus is 

like. Accordingly, the number of occurrences of computer cleared in its entirety. It cannot be analyzed as to what kind 

viruses that destroy or damage the computer systems and of virus destroyed the file. This poses a problem m that an 

that have an auto-proliferation ability has tended to increase 15 anti-vims measure cannot be examined. 

markedl y- , , SUMMARY OF THE INVENTION 

In particular, recently-procurable personal computers are 
interconnected over a network such as a local area network In view of the above-described problems, an object of the 
(LAN) and adopt the configuration enabling information present invention is to provide a storage device having a 
exchange through data communications. The fear that a 20 function, for coping with a computer virus which has the 
computer virus (hereinafter abbreviated to a virus) residing ability to prevent infection with a virus and to properly deal 
in one personal computer spreads into the other personal with an infection of a virus. 

computers connected over the network is becoming more ^ 0 so i ve the above problems, a storage device having a 

and more serious. function for coping with a computer virus in accordance 

This makes it necessary to construct a storage device 2 5 with the present invention comprises: an infection manage- 
having the ability to freely use files while preventing the ment table means used to manage files stored on a disk and 
breeding of a virus and to delete a file infected with a virus to see if the files are infected with a virus; a table registering 
or restore the infected file into an uninfected state. means for receiving a result of detection from a virus 

2. Description of the Related Art checker for detecting if a file stored on the disk is infected 
For a clear understanding of problems concerning viruses 30 with a virus, and for registering the result in the infection 

destroying computer systems, infection with a virus in a management table means; a judging means that when a use 
typical storage device will be described with reference to request is made externally for a file stored on the disk, 
j references the infection management table means so as to 

A storage device 100 basically comprises, as shown in * the ^ ^ infected with a virus; and a prohibiting 

FIG. 1, a disk 105 for storing files, and a controller 120 for 35 means tot when the judging means has Judged J* a file * 
executingdrivingcontrolfor the disk 105 and also executing ™ th a ™*' P rohlblts *» use of the f 6 - . . u 

input/output control for a personal computer 110 that is In the storage device having the function of coping with 
connected to the drive a computer virus in accordance with the present invention, 

The storage device 100 having the foregoing components ^ preferably, t be virus checker is designed to be run by the 
is designed to be directly accessed by a driver under the 40 storage device having a function for coping with a computer 
control of an operating system in the personal computer 110 virus. 

comprising a CPU 112 for processing various kinds of data, Furthermore, in the storage device having the function of 
a RAM 114 for storing various kinds of data and programs, coping with a computer virus in accordance with the present 
a ROM 116, and the like. In other words, the storage device invention, the virus checker is designed to be activated at 
yields such an environment in which; a file expanded in the intervals of a specific cycle. 

personal computer 110, one running can readily destroy More preferably, in the storage device having the function 

other files stored in the storage device. of coping with a computer virus in accordance with the 

On the other hand, a virus that intrudes from an external present invention, the virus checker is designed to be acti- 
unit into a file via a LAN adapter 130, keyboard 140, display 5Q vated in response to a command instruction. 
150, or the like rewrites another file using a physical address More preferably, in the storage device having the function 

of the file which is indicated by low-order address bits, or of coping v/ith a computer virus in accordance with the 
rewrites a system startup area such as a bootstrap using a present invention, when a writing request is issued for a 
physical address of the system startup area which is indi- system startup area stored on a disk, the table registering 
cated by low-order address bits, and thus destroys an origi- 55 means judges that a file which is stored on the disk and is a 
nal program. source of the writing request is infected with a virus and that 

This poses a problem that files stored in a storage device registers the fact in the infection management table means, 
are readily infected with a virus. More preferably, the storage device having the function of 

In an effort to cope with the above problem, a prior art coping with a computer virus in accordance with the present 
system design is adopted such that if a virus checker (not 6 o invention includes an invalidating means that when a writing 
shown) expanded in the personal computer 110 finds a file request is issued for the system startup area stored on the 
infected with a virus from among files expanded on the disk disk, invalidates the writing request. 
105 in the storage device 100, all the files expanded on the More preferably, the storage device having the function of 
disk are cleared and then originals of the files are installed coping with a computer virus in accordance with the present 
again. 65 invention includes a dedicated writing means for executing 

However, in the prior art, it is detected whether any of the writing for 1 he system startup area stored on the disk. When 
files expanded on a disk in a storage device is infected with a writing request is issued for the system startup area stored 
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on the disk, if the writing request specifies the use of the fication which is confirmed not to be infected with a virus by 
writing means, the invalidating means does not invalidate the virus checker. 

the writing request- More preferably, in the storage device having the function 

More preferably, in the storage device having the function of coping with a computer virus in accordance with the 
of coping with a computer virus in accordance with the 5 present invention, as for a file which is stored on the disk, of 
present invention, when a writing request is issued for an which origins! information is not registered in the first 
executable file stored on a disk, the table registering means managing means, and of which differential information 
judges that a file which is stored on the disk and is a source brought about due to modification is not registered in the 
of the writing request is infected with a virus and registers second managing means, the table registering means judges 
the fact in the infection management table means. io that the file stored on the disk is infected with a virus, and 

More preferably, the storage device having the function of then registers the fact in the infection management table 
coping with a computer vims in accordance with the present means. 

invention includes a permitting means for determining More preferably, the storage device having the function of 
whether a writing request made for a file that is registered as coping with a computer virus in accordance with the present 
a virus-infected file by the table registering means and that 15 invention includes a restoring means for deleting a virus- 
is running should be permitted. infected file that is registered in the infection management 
More preferably, in the storage device having the function table means from the disk, activating the file registering 
of coping with a computer virus in accordance with the means, thus restoring the file, and then registering the file on 
present invention, when a writing request is permitted by the the disk. 

permitting means, if a file that is a destination of the writing 20 More preferably, in the storage device having the function 
request is rewritten, the table registering means judges that of coping with a computer virus in accordance with the 
the file which is the destination of the writing request is also present invention, the first managing means manages ongi- 
infected with a virus and registers the fact in the infection nal information of the virus checker, and the second man- 
management table means. aging means manages differential information brought about 
More preferably, in the storage device having the function 25 due to modification concerning the virus checker and history 
of coping with a computer virus in accordance with the information concerning the differential ^formation brought 
present invention, when the size of a file is varied by running about due to modification. The storage device mcludes a 
the file, the table registering means judges that the file stored generating means for merging the ongmal information of a 
on the disk is infected with a virus and registers the fact in 3Q vinos checker which is managed by the first managmg means 
the infection management table means. with the differential information brought ^about due to modi- 
More particularly, in the storage device having the tunc- Nation concerning a vxrus checker which is managed by the 
Uon of coping with a computer vLs in accordance with the second managing means so as to reproduce the virus 
present invention, although a file stored on the disk is judged checker. * * . , 
to be an executable file in terms of the file name, if the file 35 More preferably, in the storage device having the function 
is declared to be a data file, the table registering means of coping with a computer virus m accordance with the 
judges that the file stored on the disk is infected with a virus present invention, the generating means generates a virus 
and registers the fact in the infection management table checker at the time of running a virus checker, 
means. More preferably, in the storage device having the function 
More preferably, the storage device having the function of 40 of coping with a computer virus in accordance with the 
coping with a computer virus in accordance with the present present invention, the first managing means encodes and 
invention includes a determining means for determining manages original information, and the second managing 
through interactive processing whether the use of a virus- means encodes and manages differential information 
infected file that is registered in the infection management brought about due to modification. The storage device 
table means should be permitted. The prohibiting means 4S includes a decoding means for decoding encoded data 
does not prohibit the use of a file which is permitted by the managed by the first and second managing means, and an 
determining means. encoding means for executing inverse conversion that is 

More preferably, the storage device having the function of Averse to conversion performed by the decoding means, 
coping with a computer virus in accordance with the present More preferably, the storage device having the function ot 

invention includes: a first managing means for managing 50 coping with a computer virus in accordance with the present 
original information of files stored on a disk; a second invention includes a savmg means for savmg a virus- 
managing means for managing differential information infected file that is registered in the infection management 
brought about due to modification concerning the files stored table means and virus information concerning the file m an 
on a disk, and history information concerning the differential inexecutable area, and a reading means for reading the 
information brought about due to modification; and a file 55 information saved in the inexecutable area under the con- 
registering means for merging the original information of a dition that permission information for permitting access to 
file which is managed by the first managing means and the the inexecutable area is given. 

differential information brought about due to modification In the storage device having the function of coping with 

which is managed by the second managing means so as to a computer virus in accordance with the present invention, 
produce a file, and then registering the produced file on the 60 the table registering means registers a virus-infected file 
disk. detected by the virus checker in the infection management 

More preferably, in the storage device having the function table means, 
of coping with a computer virus in accordance with the Furthermore, when a writing request is issued for a system 
present invention, the first managing means manages origi- startup area stored on a disk, since a normal file will not 
nal information that is confirmed not to be infected with a 65 issue such a writing request, the table registering means 
virus by the virus checker, and the second managing means judges that a file which is a source of the writing request is 
manages differential information brought about due to modi- infected with a virus, and registers the fact in the infection 
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management table means. This is intended to treat new, BRIEF DESCRIPTION OF THE DRAWINGS 

malign, or unusual kinds of viruses that cannot be detected ^ e a b ove objects and features of the present invention 

by the virus checker. At this time, when a writing request is ^ be more ap p areilt & orn the following description of 

issued, the invalidating means invalidates the writing gome preferred embodiments with reference to the accom- 

request. When the writing means is included, if the writing 5 . draw[n wher ein: 

request specifies the use of the writing means, the invah- ^ * * gh ^ 

dating means does not invalidate the wntmg request. r * u - \> rm r* ""r'. , Aa -T 

Moreover, when a writing request is issued for an execut- configuration of a typical storage device, 

able file stored on a disk, since a normal file will not issue FIG. 2 is a block diagram showing the configuration of an 
such a writing request, the table registering means judges 1Q embodiment based on the basic principles of the present 

that a file which is a source of the writing request is infected invention; 

with a virus and registers the fact in the infection manage- pic 3 jg a block diagram showing the configuration of the 

ment table means. The permitting means determines through fi^ preferred embodiment of the present invention; 

interactive processing whether the writing request should be mQ 4 fg a block ^gram showing the details of an 

permitted. When the permitting means ^permits the writing ^^^le TOa in FIG . 3. 

a destination of the writing request is also infected with the second preferred embodiment of the present invention 

virus and registers the fact in the infection management table FIG. 6 is a block diagram showing the configuration of the 

means third preferred embodiment of the present invention; 

When the size of a file is varied by running the file, the 20 FIG. 7 is a block diagram showing the configuration of the 

table registering means judges that the file stored on the disk fourth preferred embodiment of the present invention; 

is infected with a virus and registers the fact in the infection FIG. 8 is a block diagram showing the configuration of the 

management table means. fifth preferred embodiment of the present invention; 

Although a file stored on a disk is judged to be an ^ FIG. 9 is a block diagram showing the configuration of the 

executable file in terms of the file name, if the file is declared sixth preferred embodiment of the present invention; 

to be a data file, the table registering means judges that the FIG. 10 is a block diagram for explaining a procedure of 

file stored on the disk is infected with a virus and registers file production in accordance with the present invention; 

the fact in the infection management table means. pjQ \\ f s a block diagram for explaining a procedure of 

As for a file which is stored on a disk, of which original 3Q file storage in accordance with the present invention; 

information is not registered in the first managing means, pjQ 12 is a block diagram showing the details of a 

and of which differential information brought about due to conversion table in a ROM in accordance with the present 

modification is not registered in the second managing invention; 

means, the table registering means judges that the file stored FIG. 13 is a block diagram showing an example of a data 

on the disk is infected with a virus and registers the fact in 35 structure f or a fii e information management file in accor- 

the infection management table means. dance me pre sent invention; 

As mentioned above, when a virus-infected file is regis- FIG 14 ^ a flowchart for explaining the first example of 

tered in the infection management table means, if a data a p rocessmg flow to be executed by an embodiment of the 

processing unit makes a use request for the file stored on the pre sent invention; 

disk, the judging means references the infection manage- 40 piG 15 fe a flowchart for explaining the second example 

ment table means so as to judge if the file for which the use of a processing flow t0 be executed by an embodiment of the 

request is made is infected with a virus. On receipt of a result p resen t invention; 

of the judgment, the prohibiting means prohibits the use of nQ ±$ . g a flo ^ chart for exp i ainmg the third example of 

the file that is judged to be infected with a virus. At this time, & flow t0 be executed 5y ^ embodiment of the 

the prohibiting means does not prohibit the use of a file 45 inV e ntion . 

which is permitted by the determining means. * mQ ^ fc & n ^ chaxt for ^1^^ the fourth example 

The saving means saves, that is, stores temporarily a of a processing flow t0 be executed by an embodiment of the 

virus-infected file whose use is prohibited and virus mfor- ^ inve ^ 

mation concennng the file in the ^^^'^ FIG. 18 is a flowchart for explaining the fourth example 

reading means reads the saved ^formation from the inex- 50 rocessingflowto bee xecuted by an embodiment of the 

ecutable area and outputs it as information used for virus Wi a & j 

analysis under the condition that permission information for P^seri invenion, wrvwU „ f 

permitting access to the inexecutabie area is given. 19 » a fl fi °7* art for ^ a * mg the K^ffc 

On the other hand, the restoring means deletes a virus- * processing flow to be executed by an embodiment of the 

infected file, which is registered in the infection manage- 55 vxe ^ U ™ en ° n ' u ^ . , . . . „ vamt , v nf 

ment table means, from the disk, activates the file registering FIG. 20 is a flowchart for explaining the sixth sample of 

means, thus restores the file, and then registers the restored a processmg flow to be executed by an embodiment of the 

file on a disk. P resent mention; 

As mentioned above, the storage device having the tunc- FIG. 21 is a flowchart for explaming ^ seven^ ^example 

don of coping with a computer vims in accordance with the 60 of a processmg flow to be executed by an embodiment of the 

present invention is designed to actively prevent infection present invention; 

with a virus, prohibits the use of a virus-infected file and FIG. 22 is a flowchart for explaining the eighth example 

restores the virus-infected file automatically, and preserves of a processing flow to be executed by an embodiment of the 

information concerning infection with viruses so that the present invention; 

information cannot be accessed readily. Consequently, a 65 FIG. 23 is a flowchart for explaining the ninth example of 
storage device capable of properly dealing with infection a processing flow to be executed by an embodiment of the 

with a virus can be constructed. present invention; 
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FIG. 24 is a block diagram for explaining the first information from being rewritten. At this time, a decoding 

example of an anti-vims operation in the embodiment shown means for decoding the encoded data and an encoding 

in FIG. 2; means for executing inverse conversion that is inverse to 

FIG. 25 is a block diagram for explaining the second conversion performed by the decoding means are included 

example of the anti-virus operation in the embodiment 5 in the second managing means 12. 

shown in FIG. 2; The file registering means 13 merges the original lnfor- 

F1G. 26 is a block diagram for explaining the third nation of a file which is managed by the first mana^ng 

example of the anti-virus operation in the embodiment nieans 11 with the differential ^formation brought about due 

shown in FIG 2* to modification concerning the file which is managed by the 

« . * ' . , , . . + . f _ 10 second managing means 12 so as to reproduce the file, and 

FIG 27 is a block diagram for explaining the fourth ^ ^ ^ ^ on ^ &k m Th& generating means U 

example of the anti-virus operation in the embodiment mergeg ^ information of the virus che cker 15 

shown in FIG. 2; which fe managed by tne first managing means 11 with the 

FIG. 28 is a block diagram for explaining the fifth differential information brought about due to modification 

example of the anti-virus operation in the embodiment 15 concernm g me virus checker 15 which is managed by the 

shown in FIG. 2; second managing means 12 so as to reproduce the virus 

FIG. 29 is a block diagram for explaining the sixth checker 15. 

example of the anti-virus operation in the embodiment The virus cnec k er 15 ^ activated at intervals of a specific 

shown in FIG, 2; and period or activated in response to a command instruction, 

FIG. 30 is a block diagram for explaining the seventh 20 and detects whether a file stored on the disk 10 is infected 
example of the anti-virus operation in the embodiment ^th a virus. The infection management table means 16 is 

shown in FIG. 2. used to manage files stored on the disk and to see if the files 

nFRPPTPTTON OF THF PRFFFRRPD are infected ^ viruseS - ^ table re S ister ^ means 17 

DESCRIPTION OF TOE PREFERRED registers data in the infection management table means 16. 

LMbODlMLN 1^ 25 The judging means 18 references the infection management 

Hereinafter, the description of some preferred embodi- table means L6 in response to a use request made for a file 

ments according to the present invention will be given with stored on the disk 10 by the data processing unit 2, and 

reference to the accompanying drawings. judges if the file is infected with a virus. When the judging 

FIG. 2 is a block diagram showing the configuration of an means 18 judges that a file is infected with a virus, the 

embodiment based on the basic principles of the present prohibiting means 19 prohibits the use of the file, 

invention. The determining means 20 determines through interactive 

In the drawing, reference numeral 1 denotes a storage processing whether the use of a file registered in the infec- 

device having the function of coping with a computer virus tion management table means 16 should be permitted. The 

in accordance with the present invention. Reference numeral 35 restoring means 21 deletes a virus-infected file, which is 

2 denotes a data processing unit for executing data process- registered in the infection management table means 16, from 

ing using a file stored ic the storage device 1 having the the disk 10, activates the file registering means 13, thus 

function of coping with a computer virus. restores the Ble, and then registers the restored file on the 

Hie storagedevice 1 having the function of coping with disk 10. When a writing request is issued for a system startup 

a computer virus comprises a disk 10, first managing means 40 area stored on the disk 10, the invalidating means 22 

11, second managing means 12, file registering means 13, invalidates the writing request The writing means 23 is 

generating means 14, virus checker 15, infection manage- prepared as a defeated wntmg facihty and executes wriung 

ment table means 16, table registering means 17, judging for the system startup area stored on the disk 10. 

means 18, prohibiting means 19, determining means 20, The permitting means 24 determines through interactive 

restoring means 21, invalidating means 22, writing means 45 processing whether a writing request made for an executable 

23, permitting means 24, ^executable area 25, saving means file stored oh the disk should be permitted. The inexecutable 

26, and reading means 27. Herein, the virus checker 15 may area 25 is prepared as an area inaccessible with a normal 

be expanded in the data processing unit 2. access request. The saving means 26 saves a virus-infected 

The disk 10 stores files. The first managing means 11 file registered in the infection management table means 16 

manages original information of the files stored on the disk 50 and virus information concerning the file in the inexecutable 

10 or manages original information of the virus checker 15. area 25. The reading means 27 reads information saved in 

The second managing means 12 manages differential infer- the inexecutable area 25 under the condition that permission 

mation brought about due to modification; that is, informa- information for permitting access to the mexecutable area 25 

tion concerning upgraded versions of the files stored on the 15 given. 

disk, and history information concerning the differential 55 In the embodiment of the present invention shown in FIG. 
information brought about due to modification, or manages 2, the table registering means 17 registers a virus-infected 
differential information brought about due to modification file detected by the virus checker 15 in the infection man- 
concerning the virus checker 15; that is, information con- age ment table means 16. 

cerning an upgraded version of the virus checker 15, and Furthermore, when a writing request is issued for a system 

history information concerning the differential information 60 startup area stored on the disk 10, since a normal file will not 

brought about due to modification. issue such a writing request, the table registering means 17 

The first managing means 11 may encode and manage the judges that a file which is stored on the disk 10 and is a 

original information of the files and virus checker 15 so as source of the writing request is infected with a virus, and 

to prevent the original information from being rewritten. The registers the fact in the infection management table means 

second managing means; 12 may encode and manage the 65 16. This is intended to treat new, malign, or unusual kinds of 

differential information brought about due to modification viruses that cannot be detected by the virus checker 15. 

concerning the files and virus checker 15 so as to prevent the When the writing request is issued, the invalidating means 
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22 invalidates the writing request. However, when the accessed readily. Thus, a storage device capable of properly 
writing means 23 is included, if the writing request specifies dealing with infection with a virus can be constructed, 
the use of the writing means 23, the invalidating means 23 a storage device having the function of coping with a 

does not invalidate the writing request. computer virus, in accordance with the present invention will 

When a writing request is issued for an executable file 5 be described below in detail in conjunction with several 
stored on the disk 10, since a normal file will not issue such preferred embodiments that are more practical than the basic 
a writing request, the table registering means 17 judges that embodiment shown in FIG. 2. 

a file which is stored on the disk 10 and is a source of the fig. 3 sho ws the first preferred embodiment of the 
writing request is infected with a virus, and registers the fact storage device 1 having the function of coping with a 
in the infection management table means 16. At this time, io TOm p U te r virus in accordance with the present invention, 
the permitting means 24 determines through interactive storage device 1 having the function of coping with 

processing whether the writing request should be permitted. a computer virus in this embodiment is connected to a 
When the permitting means 24 permits the writing request, p ersoaa l computer 2a. The storage device 1 includes a disk 
since the file is rewritten, the table registering means 17 3 q for storm g fft es that are objects of access obtained by the 
judges that a file which is stored on the disk 10 and is a is personal compter 2a as well as a ROM 31 for storing 
destination of the writing request is also infected with the firmware or the like that executes access processing or 
virus, and registers the fact in the infection management anti-virus processing, a CPU 32 for running firmware stored 
table means 16. in the ROM 31 and executing data transfer to or from the 

Moreover, when the size of a file is varied by running the personal computer 2a, and a RAM 33 prepared as a work 
file, the table registering means 17 judges that the file stored 20 area use d by firmware that is run by the CPU 32, and thus 
on the disk 10 is infected v/ith a virus, and registers the fact has the capability of a CPU. 

in the infection management table means 16. storage device 1 further includes an original infor- 

Moreover, although a file stored on the disk is judged as rnation management file 34 used to manage original infor- 
an executable file in terms of the file name, if the file is ^ mation of files stored on the disk 30 and original information 
declared to be a data file, the table registering means 17 0 f a y{ ms checker prepared for inspection of the files stored 
judges that the file stored on the disk 10 is infected with a on the disk. A version update information management file 
virus, and registers the fact in the infection management 35 & m ^ to manage differential information brought about 
table means 16. due to modification concerning a file stored on the disk 30 

Moreover, as for a file which is stored on the disk 10, of 3Q and history information concerning the differential informa- 
which original information is not registered in the first tion brought about due to modification, and to manage 
managing means 11, and of which differential information differential information brought about due to modification 
brought about due to modification is not registered in the concerning the virus checker and history information con- 
second managing means 12, the table registering means 17 cerning the differential information brought about due to 
judges that the file stored on the disk 10 is infected with a 3 _ modification. A file information management file 36 is used 
virus, and registers the fact in the infection management to manage the information indicating if the files are stored on 
table means 16. the disk, and is used to determine if the original information 

As mentioned above, when a virus-infected file is regis- stored in the original information management file 34, and 
tered in the infection management table means 16, if the data the differential information (brought about due to modifica- 
processing unit 2 makes a use request for the file stored on 40 tion and which is stored in the version upgrade information 
the disk 10, the judging means 18 references the infection management file 35) are infected with viruses. The infor- 
management table means 16 so as to judge if the file for mation indicates if the files to be managed are executable 
which the use request is made is infected with a virus. On files or data files, and if the files to be managed belong to a 
receipt of a result of the judgment, the prohibiting means 19 bootstrap or an initial program loader (IPL). An inexecutable 
prohibits the use of the file that is judged to be infected with 45 area 37 which is prepared as an area that becomes accessible 
a virus by the judging means 18. At this time, the prohibiting only when a password and ID number agree with internal 
means 19 does not prohibit the use of a file which is data, and in which a file infected with a virus and virus 
permitted by the determining means 20. ■ information concerning the file are saved, has a data struc- 

The saving means 26 saves the virus-infected file whose ture shown in FIG. 4. Herein, the reason why the version 
use is prohibited and virus information concerning the file in 50 u P date information management file 35 manages history 
the inexecutable area 25 that cannot be accessed readily. The information is to make apparent which is the latest drfter- 
reading means 27 reads the saved information from the ential information brought about due to modification, 
inexecutable area 25 under the condition that permission The inexecutable area 37 shown in FIG. 4 includes an 
information for permitting access to the inexecutable area 25 infected-file storage area that is a storage area in which files 
is given, and outputs the read information as information 55 infected with viruses are stored, and a virus information 
used for virus analysis. storage area that is a storage area in which virus information 

On the other hand, the restoring means 21 deletes a of the viruses is stored. Furthermore, the virus information 
virus-infected file registered in the infection management storage area contains detailed information; such as, names of 
table means 16 from the disk 10, activates the file registering infected files that are infected with viruses, storage locations 
means 13, thus restores the file, and registers the file on the 60 of the infected files, sizes of the storage locations of the 
disk 10 infected files, sizes of virus information, name of viruses, 

As mentioned above, the storage device 1 having the and the infojmation indicating if the viruses are of a system 
function of coping with a computer virus shown in FIG. 2 is area infection type or a file infection type and the mforrna- 
designed to actively prohibit infection with a virus, to tion indicating if the viruses are of a file destruction type or 
prohibit the use of a file infected with a virus and restores the 65 me like * 

file automatically, and to preserve information concerning Further included is a controller 38 for accessing a file 
infection with viruses so that the information cannot be stored on the disk, accessing original information managed 
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in the original information management file 34, accessing version. The original information of the vims checker is 
the differential information brought about due to modifica- stored in the original information management file 34. 
tion and history information which are managed in the Differential information brought about due to modification 
version upgrade information management file 35, or access- concerning the upgraded version and his ; ory informaUo° 
ing information saved in the inexecutable area 37. 5 concerning the differential information brought aboutdue to 

m & im.uim modification are stored in the version upgrade information 

Herein, the original information management hie 34 and mana gement file 35. Thus, the virus checker is managed, 
version upgrade information management file 35 are not incidentally when the original information management 
designed to enable management of original information and fifc 34 and version upgra de information management file 35 
differential information brought about due to modification afe cons^^d on the same medium, original information of 
from the viewpoint of a mere difference but may be designed 10 fileg and a vi]1IS decker, differential information brought 
to enable management of original information and differen- about ^ tQ modification concerning the files and virus 
tial information brought about due to modification on the checker, and history information concerning the differential 
basis of a relationship of succession including a parent-child information brought about due to modification can be man- 
relationship, aged totally. This is convenient in practice. In addition, the 

In the first preferred embodiment shown in FIG. 3, the 15 disk 30 and inexecutable area 37 may be constructed on the 
storage device 1 having the function of coping with a medium. 

computer virus is connected to the personal computer 2a. Original information of files and a virus checker which is 

Aside from this, like the second preferred embodiment stored in the original information management file 34, and 
shown in FIG. 5, the storage device 1 may be connected over ^ differential information brought about due to modification 
a LAN. In the embodiment shown in FIG. 3, the original concerning the files and virus checker and history informa- 
information management file 34 and version upgrade infor- t i on concerning the differential information brought about 
mation management file 35 are separate files. In the third due to modification which are stored in the version upgrade 
preferred embodiment shown in FIG. 6 and the fourth information management file 35 must not be rewritten by the 
preferred embodiment shown in FIG. 7, the original infer- ^ personal computer 2a. 

mation management file and version upgrade information The s t ora ge device 1 having the function of coping with 
management file may be formed with one file. This kind of a com p U t er virus has the configuration in which original 
file is realized in the form of an original information/version information 34a of files and a virus checker which is stored 
upgrade information management file 34/35 shown in FIGS. ^ tfcie original information management file 34, and differ- 
6 and 7. In the embodiment shown in FIG. 7, a personal ^ ential information brought about due to modification con- 
computer and a storage device having the function of coping cerning the files and virus checker and history information 
with a computer virus are united by combining the configu- concerning the differential information brought about due to 
rations shown in FIGS. 5 and 6. The embodiment shown in modification which are stored in the version upgrade infor- 
FIG. 3 has the configuration in which the storage device 1 ma tion management file 35 are encoded, and in which a 
having the function of coping with a computer virus is ^ decoding mechanism for decoding encoded data is made 
installed outside the personal computer 2a. Alternatively, rea dy. As shown in FIG. 10, the original information of a file 
like the fifth preferred embodiment shown in FIG. 8 and the 0f v | rus cnec k er decoded by the decoding mechanism is 
sixth preferred embodiment shown in FIG. 9, the storage merged with the differential information brought about due 
device may be installed inside the personal computer 2a. To tQ mo dification concerning the file or virus checker which is 
be more specific, in the embodiment shown in FIG. 8, the ^ decoded by the decoding mechanism in order to reproduce 
original information management file 34 and version t ^ e file 0f viras cnec k er Moreover, an encoding mechanism 
upgrade information management file 35 are separate files. for executm g inverse conversion that is inverse to conver- 
In the embodiment shown in FIG. 9, both the files are s - on p er f orm ed by the decoding mechanism is made ready, 
formed with one file. p& shown in FIG. 11, the original information of files and a 

The storage device 1 having the function of coping with 45 virus checker which is encoded by the encoding mechanism 
a computer virus in accordance with the present invention stored in the original information management file 34. The 
has, as mentioned above, the configuration including the differential information brought about due to modification 
original information management file 34 and version and history information 35a concerning the files and virus 
upgrade information management file 35. checker which are encoded by the encoding mechanism are 

The foregoing configuration is adopted for the following 50 stored in the version upgrade information management file 
reasons: original information of a file stored on the disk 30 35. 

is stored in the original information management file 34; More part icularly, the encoding mechanism and decoding 

when the file is upgraded into a new version, differential mechanism are realized by firmware stored in an area 312, 
information brought about due to modification concerning which is reserved in order to store firmware, in the ROM 31 
the upgraded version and history information concerning the 55 in the storage device 1 having the function of coping with a 
differential information brought about due to modification computer vims. For realizing the mechanisms, as shown in 
are stored in the version upgrade information management FIG. 12, a conversion table 310 is used to encode original 
file 35; and in case a file stored on the disk 30 is infected information, differential information brought about due to 
with a virus, the file can be restored by merging the original modification, and history information, and a conversion 
information of the file with differential information brought 60 table 311 is used to decode the original information, differ- 
about due to modification. Moreover, since original infor- ential information brought about due to modification, and 
mation of a file and differential information brought about history info rmation which are encoded are stored in the 
due to modification concerning the file are not expanded on ROM 31. 

the disk 30, it can be prevented that these kinds of infor- Furthermore, the storage device 1 having the function of 
mation are infected with a virus. 65 coping with a computer virus in accordance with the present 

A virus checker prepared for inspection of a file stored on invention includes the file information management file 36 
a disk also has the possibility of being upgraded into a new as mentioned above. 
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The file information management file 36 manages the storage area and virus information storage area (storage 

information indicating if files stored on the disk 30, original areas shown in FIG. 4) within the inexecutable area 37 (step 

information stored in the original information management S141). Thereafter, initialization is executed by registering an 

file 34, and differential information brought about due to ID number and password needed to access the inexecutable 
modification which is stored in the version upgrade infor- 5 area 37 (step S142). 

mation management file 35 are infected with viruses, the Qn tfae ol ^ QT for registering original information of 

information indicating if these files to be managed are a purc h aS ed file in the original information management file 

executable files or data files, and the information mdicatmg 34 or f Serine differential information brought about due 

that the files to be managed belong to a bootstrap or an IPL. to modification concerning the file in the version upgrade 
FIG. 13 shows an example of a data structure for the file 1Q infonMtion manageme nt file 35, the storage device 1 having 

formation management file 36. The ex ample shown in ^ a uter ^ 6S origina i 

FIG. 13 is devised on the assumption that a fik whch is ion of a 4J checker whicn isstored in theoriginal 

stored on the disk and writes a bootstrap or an IPL is judged HiiWntial 

to be infected with a virus, and that a file which is stored on information management file 34 with the latest ditoen ial 

thediskandwritesanexecutable file isjudgedtobe infected mformaUon brought about due to 

with a virus. This is attributable to the fact that a normal file 15 the virus checker which is stored m the version upgrade 

will not perform the former writing and will not in general information management file 35. Thus the virus checker is 

perform the latter writing, either. reproduced and expanded m the RAM 33. 

Specifically, the file information management file 36 As shown in the second example of a processing flow in 

manages, as shown in FIG. 13, file names of files to be FIG. 15, the reproduced virus checker is used to check if a 
managed, addresses of the files, execution/data type flags 20 fii e registered (original information and differential infor- 

indicating whether the files are executable files or data files, mation brought about due to modification) is infected with 

and starting portion flags indicating if the files belong to a a virus ( step §151). if it is judged that the file is infected with 

bootstrap or an IPL. File information management file 36 a m e Mected file and virus information concerning 

also manages: infection flags <1> indicating if it is detected tfae me af6 saved ^ the i neX ecutable area 37 (step S152). 
by a virus checker that the files are infected with viruses, 25 Use p ro kibited Due To Infection With a Virus is reported to 

infection flags <2> indicating if it is judged according to ^ onal compu ter 2a that is a source of registration (step 

whether or not writing the bootstrap or IPL is attempted that §153) 

the files are infected with viruses, infection flags <3> ; * . . . c 0 ^ o a 
indicating if it is judged according to whether or not writing By contrast when 1 is judged that a file is no infected 
an executable Me is attempted mat themes are infected with 30 with a virus, the file is stored m the original information 
a virus, infection flags <4> indicating if original information management file 34 and version upgrade information man- 
stored in the original information management file 34 is agement file 35 which are destinations of registration. His- 
Mected with a virus, and infection flags <5> indicating if tory information is created and stored ^e versxon upgrade 
differential information brought about due to modification information management file 35 (step S154). The nle (wnen 
which is stored in the version upgrade information manage- 35 a registered file contains differential mformation brought 
ment file 35 is infected with a virus. Thus, the aforesaid about due to modification, the file is a file created by 
information is managed. Whether or not original informa- merging the information with original mformation) is then 
tion stored in the original mformation management file 34 is expanded on the disk 30. At the same time data is re^stered 
infected with a virus and whether or not differential infor- in the file information management file 36 (step S155). 
mation brought about due to modification which is stored in 40 As mentioned above, original information of a file which 
the version upgrade information management file 35 is is not infected with a virus is registered in the original 
infected with a virus is judged by the virus checker or information management file 34. Differential information 
according to whether writing the bootstrap, the IPL, or an brought about due to modification concerning the file which 
executable file is attempted. is not infected with a virus is registered in the version 

Herein, in the storage area of an execution/date type flag, 45 upgrade information management file 35. Afile that contains 

"1" is set relative to an executable file and "0" is set relative the original information merged with the differential infor- 

to a data file. In the storage area of a starting portion flag, "1" mation brought about due to modification and that is not 

is set in case a file belongs to a bootstrap or IPL, and "0" is infected with a virus is then expanded on the disk 30. Herein, 

set in any other case. In the storage area of infection flag <1> the reason why the system is designed so that a virus checker 

or <2>, " 1" is set when infection with a virus is detected, and 50 is not stored on the disk 30 in advance but produced prior to 

"0" is set when infection with a virus it not detected. In the checking on infection with a virus is to prevent the virus 

storage area of infection Bag <3>, "1" is set when infection checker itself from being infected with a virus, 

with a virus is suspected, and "0" is set when infection with i n the second example of a processing flow in FIG. 15, it 

a virus is not suspected. In the storage area of infection flag ^ confirmed that original mformation of a file registered in 

<4> or <5>, "1" is set when infection with a virus is 55 the original information management file 34 is not infected 

suspected, and "0" is set when infection with a virus is with a virus, and it is also confirmed that differential 

neither detected nor suspected. information brought about due to modification concerning 

FIGS. 14 to 23 describe some examples of processing the file registered in the version upgrade information man- 
flows executed by the storage device 1 having the function agement file 35 is not infected with a virus. A file that is 
of coping with a computer virus which is configured as 60 expanded on the disk 30 by merging original information 
mentioned above. Next, operations performed by the storage with differential information brought about due to modifi- 
device 1 having the funct ion of coping with a computer virus cation is checked by processing that will be described later 
in accordance with the present invention will be described in in order to see if the file is infected with a virus. The 
detail in conjunction with these examples of processing confirmation is therefore not absolutely needed. In the 
flows. 65 description of the second example of a processing flow in 

When activated, the storage device 1 having the function FIG. 15, the storage device 1 having the function of coping 

of coping with a computer virus initializes the infected-file with a computer virus actuates a virus checker. Alternatively, 
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the system may be designed so that the personal computer 2a At step S177, it is judged that all the files stored on the 
actuates the virus checker. disk 30 have been processed. If it is judged that an unproc- 
As mentioned above, in this embodiment of the present essed file is left, control is returned ^to step S 173 If it is 
invention, it is judged that a file being stored on the disk 30 judged that no unprocessed file is left, control * pa^d to 
andattemptingto4iteabootstraporanIPLisinfectedwith 5 step S178. It ,s judged if a mode, in which original infor- 
a virus. This I attributable to the fact that a normal file will rnaUon stored m the original ^^^^^ 
. . 34 and differential information brought about due to modi- 
not perform such writing. flcation which is stored in the version upgrade information 
As described later since the present invention adopts the ement fik 35 are also subjected t0 ^ check) is 
system design of prohibiting a file mfected wUh a virus from ^ d ^ * ted I{ ^ mode in which both me origilia i ioforma- 
running, a file attempting to write a bootstrap or IPL is differential information brought about due to modi- 
prohibited from running. This means that the bootstrap or fication afe BBtjectod t0 virus check js not designated, 
IPL cannot be registered. In the present invention, therefore, ^ (o sm 
when a specific command instructing registration or the , i_ j • u - lk 
bootstrap or IPL is issued, the registration is permitted. ^ By contrast, if it is judged that me mode, in which bo^Ae 
y . , , . ' . , a • 15 original information stored m the original information man- 
As shown m the third example of a processing flow in ^ ^ ^ ^formation brought 
FIG. 16, whenaspecificcommandinstructingregBtrationof {o modificatioQ wUch is stored m the version 
a bootstrap of IPL is issued, the storage device 1 haying he Monn&tioa management file 35 are also subjected 
taction of coping with a computer virus registers the « fa ^^J^ fa sed to step S 181 
bootstrap or IPL, for which a registration request has been 2Q described m nG 18 Qn6 of the orfeinal ^formation and 

" f 0 ™* 11011 ?pT a S R AMi3 ( ^d differentialinlormationbroughtaboutdue to modification is 

S161), and fetches the bootstrap or IPL into the RAM 33 and ded ^ WQrk ^a m the RAM 33. At step S182, the 

S ^ S 1 t. ^ 30 ( f P , S162) - J ^ r, S P^uced virus checker is used to check if the file expanded 
the disk 30, -1- is set m the storage area of a starting portion P ^ ^ fe ^ a ^ ^ vims check for 

flagm^fite m formationmamgernentme 36 - ft * thus ^ infonna tion or differential information brought 

registered that a file stored ,s a bootstrap or IPL. 1 is set S modification is carried out in order to deal with 

in the storage area of an execution/data type flag whereby ace of a new ^ of ^ 

it is registered that the hie stored is an executable tile. & ■ . , 

Infectio! flags <1> to <5> are set to "0," whereby it is **»?^*¥™^^J^XZ^ 

registered that the file stored is not infected with avirus(step with a virus <x,ntrol is passed to step S 183 . _ V « forded 

s foy. M as infection flags <4> and <5> associated with the file in the 

kt . • • t * a «i j.*.„ti«« t„ h» »v^,tpH hv thr» file information management file 36. It is thus registered that 

Next, vxrus-infected file detection to be executed by the infected with a virus. By contrast, when it is 

storage device 1 having the funcUon of coping with a vinjs fa d 

computer virus will be described. The detection Ms nto J infection <4> ^ <5> 

two procedures; a procedure to be ^ ^ 35 assoc ? ted ^ the ffle m ^ file mfc^n management 

^ ofa'wr^tluo^ \lTnd S 36. It is thus registered that the original information is 

describe a processing flow of virus-infected file detection to mtected witn a virus. ..... ,. 

be executed using a virus checker (first half and second half At step S185, it is judged if all original information and 
of the fourth example). FIG. 19 describes a processing flow « differential information brought about due to modification 
(fifth example) of virus-infected file detection to be executed have been processed. If it is judged that an unprocessed file 
by judging the attribute of a writing-destination file. is left, control fe returned to step S181 If it k judged I that no 
For Selecting a virus-infected file using a virus checker, ™P^ssed file is left, control is returned to step S171 in 
the storage device 1 having the function of coping with a bllj - 1 • . . 
computervirusfirstwaits,asdescribedinthefourthexample 45 As mentioned above the storage device 1 having the 
of a processing flow shown in FIGS. 17 and 18, for the start function of coping with a computer virus uses a virus 
of a period of detecting a virus-infected file. When it is checker to periodically check if files stored on the disk 30, 
judged that the detecting period starts, control is passed to original information stored m the original information man- 
step S172. Original information of a virus checker which is agement file 34, and differential information brought about 
stored in the original information management file 34 is 50 due t0 modification which is stored in the version upgrade 
merged with the latest differential information brought about information management file 35 are infected with viruses 
due to modification concerning the virus checker which is The results of the check are registered m the form of 
stored in the version upgrade information management file infection flags <1>, <4>, and <5> m the file information 
35 in order to produce the latest virus checker. The produced management file 36. 

virus checker is expanded in the RAM 33. 55 In the fourth example of a processing flow shown in 

Thereafter, one of the unprocessed files on the disk 30 is FIGS. 17 and 18, a virus checker is activated at intervals of 

extracted at step S173. At step S174, the produced virus a specific period. Alternatively, the system may be designed 

checker is used to check if the extracted file is infected with so that the virus checker is activated in response to a 

a virus. When it is judged by the checking that a file is command issued from the personal computer 2a. Moreover, 
infected with a virus, control is passed to step S175. "1" is 60 in the fourth example of a processing flow in FIGS. 17 and 

recorded as infection flag <1> associated with the file in the 18, the storage device 1 havmg the function of coping with 

file information management file 36, whereby it is registered a computer virus actuates a virus checker. Alternatively, the 

that the file is infected with a virus. By contrast, when it is system may be designed so that the personal computer 2a 

judged that the file is not infected with a virus, control is actuates the virus checker. 

passed to step S176. "0" is recorded as infection flag <1>, 65 On the other hand, for detecting a virus-infected file by 

whereby it is registered that the file is not infected with a judging the attribute of a writing-destination file, when a 

virus. writing request for a file stored on the disk 30 is issued from 
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the personal computer 2a (the writing request is issued by a function of coping with a computer virus judges that a file 

file loaded from the disk 30 to the personal computer 2a), as which is a source of the writing request is infected with a 

described in the fifth example of a processing flow in FIG. virus. The fact is registered in the form of mfecUon flags . <3> 

19 the storage device 1 having the function of coping with and <3> in the file information management file 36. It the 

a computer virus first references the value of a starting 5 writing-destination file belongs to the bootstrap or IPL, 

portion flag in the file information management file 36 so as executing writing is disabled. If the wntmg-destination tile 

to judge if the writing-destination file belongs to a bootstrap is an executable file, it is determined through ^active 

or jPL processing if writing should be executed for the file. When 

If it is judged by the judgment at step S191 that the writing is executed it is judged that ihc wi^^sttoto 
JLVcLsSLn file bdjto the bootstrap or IPL, 10 file will also be infected 

control is passed to step S19Z It is then judged that the file m the form oi infection flag <3> m the file information 

having issued the writing request is infected with a virus. "1" management hie 3t>. ^ 

is recorded as infection flag <2> associated with the file in Next, processing to be executed for a vinis-infected file by 

the file information management file 36, whereby it is the storage device 1 having the function of coping with a 
registered that the file is infected with a virus. At step S193, 15 computer virus will be described. 

it is reported to the personal computer 2a that the file which When receiving a loading request made for a file 

made the writing request is a file infected with a virus. The (executable file) stored on the disk 30 from the personal 

processing is then terminated without writing. computer 2a, as described in the sixth example of a pro- 

By contrast, if it is judged at step S191 that the writing- cessing flow in FIG. 20, the storage device 1 having the 
destination file does not belong to the bootstrap or IPL, 20 function of coping with a computer virus references infec- 
control is passed to step S194. The value of an execution/ tion flags <1>, <2>, and <3> in the file information man- 
data type flag in the file information management file 36 is agement file 36 (step S201) so as to check if the file for 
referenced in order to judge if the writing-destination file is which the loading request is made is infected with a virus, 
an executable file or data file. If it is judged that the When it isjudged that the file is not infected with a virus, the 
writing-destination file is a data file, writing is executed for 25 file is loaded into the personal computer 2a. Running the file 
the file at step S195. The processing is then terminated. is thus instructed (step S202). By contrast, when it isjudged 

By contrast, if it is judged at step S194 that the writing- that the file is infected with a virus loading the file is 

destination file is an executable file, it is judged that it is rejected (step S203). Running the file is thus prevented, 

highly probable that the file having issued the writing As mentioned above, the storage device 1 having the 

request is infected with a virus. Control is then passed to step function of coping with a computer virus gives control so 

S196. While the fact is being reported, a message asking if that a virus-infected file registered in the file information 

writing should be executed is output to the personal com- management tile 36 will not be run. Consequently, a file that 

puter 2a A response to the inquiry is duly received. is detected to be infected with a virus by a virus checker will 

If it is judged at step S196 that the response from the 35 never be run. A file that has evaded checking by the virus 

personal computer 2a instructs that writing should not be checker and that is detected to be infected with a vmis m 

executed, control is passed to step S197. "1" is recorded as terms of the attribute of a writing-destination file wiU not be 

infection flag <3> associated with the file, which has issued rerun. Thus, proliferation of the virus can be reliably pre- 

the writing request, in the file information management file vented. 

36, whereby it is registered that the file is infected with a 4Q In the sixtti example of a processing flow in FIG. 20, 

virus. The processing is then terminated. running a file infected with a virus is rejected without 

Herein, even when a file that is a source of a writing exception. However, a program may be produced to have a 

request writes itself, "1" is recorded as infection flag <3> pattern resembling the pattern of a virus, and a virus checker 

associated with the file in the file information management may make a mistake in checking. The system may therefore 

file36 Thisisattributablenotonlytothefactthatitishighly 4S be designed so that it is determined through interaction iwitti 

probable that a file attempting to write an executable file is the personal computer 2a whether the run rejection should 

infected with a virus, but also to the system design of the be lifted. 

present invention that upgrading a file into a new version is On the other hand, when a command instructing restora- 

realized by registering differential information brought tion of a virus-infected file stored on the disk 30 is issued 

about due to modification in the version upgrade information 50 from the personal computer 2a, as described in the seventh 

management file 35 and that upgrading a file into a new example of a processing flow in FIG. 21, the storage device 

version without following this procedure is illegal. 1 having the function of coping with a computer virus first 

By the way, if it is judged at step S196 that a response references infection flags <1> <2>, and <3> in the file 

from the personal computer 2a instructs that writing should information management file 36, extracts one file infec ted 

be executed, although it is highly probable that the file that 5 5 with a virus, and deletes the file from the disk 30 at step 

I a Source of the writing request* infected with a vims, it S211. At step S212, the data of the deleted file is deleted ^ 

is instructed to ignore the probability. Control is therefore from the file information management file 36. 

passed to step S198. Writing is executed for the writing- At step S213, infection flag <4> in the file information 

destination file. At step S199, "1" is recorded as infection management file 36 is referenced, and original information 

flags <3> associated with the writing-source and writing- 60 of the deleted file, which is not infected with a virus, is read 

destination files in the file information management file 36, from the orijnnal information management file 34. Infection 

whereby it is registered that the files are infected with a flag <5> in the file information management file 36 is 

virus. The processing is then terminated. referenced, and the latest differential information brought 

As mentioned above, when a writing request is issued for about due to modification concerning the deleted file, which 

a file stored on the disk 30, if the writing-destination file 65 is not infected with a virus, is read from the original 

belongs to a bootstrap or IPL, or if the writing-destination information management file 34. The original ^formation is 

file is an executable file, the storage device 1 having the then merged with the differential information brought about 
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due to modification in order to restore the deleted file. The expanded on the disk 30. At step S227, data of the restored 

restored file is then expanded on the disk 30. At step S214, file is registered in the file information management file 36. 

data of the restored file is registered in the file information At step S228, it is judged if an unprocessed virus-infected 

management file 36. At step S215, it is judged if an unproc- file is left. If no unprocessed file is left, the processing is 

essed virus-infected file is left. If no unprocessed file is left, 5 terminated. If an unprocessed file is left, control is returned 

the processing is terminated. If an unprocessed file is left, to step S221. 

control is returned to step S211. As mentioned above, the storage device 1 having the 

As mentioned above, the storage device 1 having the function of coping with a computer virus deletes a file 

function of coping with a computer virus deletes a file infected with & vims fiom the disk 30, restores the file into 

infected with a virus from the disk 30. Original information 10 an uninfected one that is not infected with a virus using 

of the file and differential information brought about due to original information and differential information brought 

modification are used to restore the infected file into an about due to modification concerning the file, and expands 

uninfected one. The file not infected with a virus is then the restored file on the disk 30. At this time, the file infected 

expanded on the disk 30. with a virus and virus information concerning the file are 

In the seventh example of a processing flow in FIG. 21, 15 saved in the inexecutable area 37. 

when a restoration command is issued for a vims-infected The virus-infected file and virus information concerning 

file from the personal computer 2a, restoring the virus- the file, which are saved in the inexecutable area 37, become 

infected file is executed. Alternatively, the system may be very useful information for analysis of an intruding virus, 

designed so that restoration is executed at intervals of a However, if anybody is allowed to access this kind of useful 

specific period. Restoring the virus-infected file may thus be 20 information, tlhere arises a fear that the information may be 

executed. When this system design is adopted, a file infected rewritten by mistake. . 

with a virus can be restored autonomously irrespective of the When a coi:nmand instructing reading of saved informa- 

personal computer 2a. In the seventh example of a process- tion from the inexecutable area 37 is, issued from the 

ing flow in FIG. 21, the latest differential information personal computer 2a, as describe in the ninth example of a 

brought about due to modification which is not infected with 25 processing flo w in FIG. 23, the storage device 1 having the 

a virus is used to restore a file infected with a virus into the function of coping with a computer virus first requests entry 

latest one. Alternatively, the system may be designed so that of an ID number and password which have been registered 

differential information brought about, due to modification according to the processing flow (first example) described in 

which is identified by an instruction sent from the personal FIG. 14 (step S231), and collates the ID number and 

computer 2a and pointed out by history information is used 30 password entered in response to the request with those 

for restoration. registered according to the processing flow in FIG. 14 to see 

When the seventh example of a processing flow in FIG. if they agree with each other (step S232). Under the condi- 

21 is employed, the storage device 1 having the function of tion that they agree with each other, a virus-infected file and 

coping with a computer vims executes the processing of vims infornution which are saved in the inexecutable area 

restoring a file infected with a virus into an uninfected file. 37 are read ;ind output to the personal computer 2a (step 

At this time, as described in the eighth example of a S233). When a deletion request is issued for the extracted 

processing flow in FIG. 22, the file infected with a virus and virus-infected file and virus information from the personal 

virus information concerning the file-infected file may be computer 2a (step S234), deletion is executed (step S235). 

saved in the inexecutable area 37. As mentioned above, the storage device 1 having the 

Specifically, according to the eighth example of a pro- function of coping with a computer virus reads a virus- 

cessing flow in FIG. 22, when a command instructing infected file and virus information, which are saved in the 

restoration of a virus-infected file stored on the disk 30 is inexecutable area 37, under the condition that an ID number 

issued from the personal computer 2a> the storage device 1 and password agree with internal data, 

having the function of coping with a computer virus first 45 In the ninth example of a processing flow in FIG. 23, 

references infection flags <1>, <2>, and <3> in the file when a Read command is issued for the inexecutable area 37 

information management file 36 and extracts one file from the personal computer 2a, saved information is read 

infected with a virus at step S221. At step S222, a virus from the inexecutable area 37. Alternatively, the system may 

checker expanded in advance is used to specify virus infor- be designed so that the saved information is read from the 

mation concerning the extracted virus-infected file. At step 50 inexecutable area 37 by executing reading at intervals of a 

S223, the extracted virus-infected file and virus information specific period. For further improving security, an encoding 

specified at step S223 are saved in the inexecutable area 37. mechanism for converting a virus-infected file and virus 

At step S224, the extracted virus-infected file is deleted from information, which are saved in the inexecutable area 37, 

the disk 30. into encoded data may be prepared. The encoded data 

At step S225, data of the deleted file is deleted from the 55 produced by the encoding mechanism is then stored in the 

file information management file 36. At step S226, infection inexecutable area 37. In addition, a decoding mechanism for 

flag <4> in the file information management Be ^6 is executing inverse conversion that is inverse to the conver- 

referenced, and original information of the deleted file which sion performed by the encoding mechanism may be pre- 

is not infected with a virus is read from the original P«A ^ the vims-infected file and virus infor- 

infonnation management file 34. Infection flag <5> in the 60 mation which are saved in the inexecutable area 37 are read 

file information management file 36 is referenced, and the toe decoding mechanism. 

latest differential information brought about due to modifi- FIGS. 24 to 30 are block diagrams for explaining several 

cation concerning the deleted file which is not infected with examples (first to seventh examples) of an anti-virus opera- 

a virus is read from the original information management tion performed in the basic embodiment shown in FIG. 2, 

file 34. The original information is then merged with the 65 In the storage device 1 having the function of coping with 

differential information brought about due to modification in a computer vims in accordance with the present invention 

order to restore the deleted file. The restored file is then shown in FIG. 2, as shown in FIG. 24 for explaining the first 
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example of an anti-virus operation, a virus checker 40 management file 35. When the timer 44 issues an instruction 
(which may be run by the personal computer 2a or storage for a virus check, the file generating mechanism 42 gener- 
device 1 having the function of coping with a computer ates the virus checker 40. The thus-generated virus checker 
virus) checks if a file expanded on the disk 30 is infected 40 (that may be run by the personal computer 2a or storage 
with a virus. The result of the checking is received and 5 device 1 having the function of coping with a computer 
registered in the file information management file 36. Thus, virus) checks if a file expanded on the disk is infected with 
the file information management file 36 is used to manage a virus. The result of the checking is registered in the nle 
the information indicating if files expanded on the disk 30 information management file 36. Thus, the virus checker 40 
are infected with viruses. Furthermore, as shown in FIG. 25 is protected from being infected with a virus, and intrusion 
for explaining the second example of an anti-virus 10 of the virus is prevented. Alphanumeric characters in paren- 
operation, when a use request is made for a file expanded on theses (ID) to (3D), (3E), (4D), and (5D) m FIG. 27 and 
the disk30 via thepersonal computer 2^, the file information (IF), (2F), (23?)', (3F) to (5F) in FIG. 28 denote processing 
management file 36 is referenced to judge if the file for orders. 

which the use request is made is infected with a virus. If the The storage device 1 having the function of coping with 

file is infected with a virus, the use of the file is prohibited. l5 a computer virus in accordance with the present invention, 
Thus, proliferation of the virus is prevented. which has the configuration shown in FIG. 2, includes, as 

In 'fIGS. 24 and 25, reference numeral 41 denotes a shown in FIG. 29 for explaining the sixth example of an 
management file registering/referencing mechanism for reg- anti-virus operation, a virus check starting mechanism 45 for 
istering data in the file information management file 36 and issuing an instruction of virus check in response to an 
referencing the file information management file 36 for data. 20 instruction sent from the personal computer 2a. 
When the system is designed so that the virus checker 40 is Furthermore, encoded data of original information of the 
run by the storage device 1 having the function of coping virus checker 40 is stored in the original information man- 
with a computer virus, checking on an infection with a virus agement file 34. Encoded data of differential information 
can be executed concurrently with an operation of the brought about due to modification concerning the virus 
personal computer 2a, Moreover, checking on an infection 25 checker 40 is stored in the version upgrade information 
with a virus can be executed at night or the like. In case the management file 35. When the virus check starting mecha- 
virus checker 40 is run by the personal computer 2a, the nism 45 issues an instruction of virus check, the file gener- 
virus checker 40 may not be loaded from the storage device ating mechanism 42 generates the virus checker 40. The 
1 having the function of raping with a computer virus but thus-generated virus checker 40 (that may be run by the 
may be prepared separably. Alphanumeric characters in 30 personal computer 2a or storage device 1 having the func- 
P arentheses(lA)to(5A)inFIG.24and(lB)to(3B),(3B)', tion of coping with a computer virus) checks if a file 
(4B) and (5B) in FIG. 25 denote processing orders. expanded on the disk 30 is infected with a virus. The result 

The storage device 1 having the function of coping with of the checking is registered in the file information man- 
a computer virus in accordance with the present invention, agement file 36. Thus, the virus checker 40 is protected from 
which has the configuration shown in FIG. 2, includes, as 35 being infected with a virus and mt ™^^^; s 
shown in FIG. 26 for explaining the third example of an prevented. Alphanumeric characters (1G) to (30), 
anti-virus operation, an original information management (4G) to (6G) in the drawing denote processing orders, 
file 34 for encoding and managing original information of Moreover, the storage device 1 having the function of 
files, a version upgrade information management file 35 for coping with a computer virus in accordance with the present 
encoding and managing differential information brought 40 invention, which has the configuration shown m FIG. 2 
about due to modification concerning the files, a file gener- includes, as shown in FIG. 30 for explaining the seventh 
ating mechanism 42 for decoding and merging encoded data example of an anti-virus operation, a dedicated system 
of original information and differential information brought writing mechanism 46 for writing a bootstrap or IPL on the 
about due to modification so as to generate a file, and a disk 30. When the system writing mechanism 46 is used to 
deleting mechanism 43 for deleting a file from the disk 30. 45 run a program, writing the bootstrap or IPL on the disk 30 
When it is judged that a file for which a use request is made is permitted. This is intended to guarantee normal writing as 
is infected with a virus, the deleting mechanism 43 is used an exception to the rule that a file attempting to wnte the 
to delete the virus-infected file from the disk 30. The file bootstrap or IPL on the disk 30 is judged to be infected with 
generating mechanism 42 is used to restore the virus- a virus and ithat executing the file is prohibited, 
infected file into an uninfected one that is not infected with 50 In the aforesaid examples shown in FIGS. 24 to 30, a file 
a virus and expand the file on the disk 30. The system can infected with a virus is detected by the virus checker 40. In 
therefore be operated by performing a minimum scale of addition, a file attempting to write a bootstrap or IPL or an 
installation. In the drawing, alphanumeric characters in executable file is judged to be infected with a virus. Aside 
parentheses (1C) to (14C) denote processing orders. from this, if the criteria described below are added, infection 

Moreover, the storage device 1 having the function of 55 with a virus can be prevented more reliably. That is to say, 
coping with a computer virus in accordance with the present when the size of a file is varied by running the file, the file 
invention, which has the configuration shown in FIG. 2, stored on the disk 30 is judged to be infected with a virus (for 
includes, as shown in FIG. 27 for explaining the fourth example, judged periodically). Although a file stored on the 
example of an anti-virus operation, a timer 44 for issuing a disk 30 is judged to be an executable file in terms of the fine 
virus check instruction periodically (which may be incor- 60 name, if the file is declared to be a data file in the file 
porated in the personal computer 2a as shown in FIG. 28 for information management file 36, the file stored on the disk 
explaining the fifth example of an anti-virus operation). 30 is judged to be infected with a virus (for example, judged 
Furthermore, encoded data of original information of the at the start of processing). Although a file is stored on the 
virus checker 40 is stored in the original information man- disk 30, if original information is not registered in the 
agement file 34. Encoded data of differential information 65 original information management file 36 and differential 
brought about due to modification concerning the virus information brought about due to modification is not regis- 
checker 40 is stored in the version upgrade information tered in the version upgrade information management file 
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37 the file stored on the disk 30 is judged to be infected with determining unit for determining through interactive pro- 

a virus (judged periodically or at the time of access to the cessing whether the use of a virus-infected file that is 

file) " registered in said infection management table unit should be 

** , . . f fil . . AU fUa fiu permitted, wherein said prohibiting unit does not prohibit 

Checking if the size of a file is varied by runmng the file ^ ^ ^ fe said determining ^ 

is achieved by, for example, merging original information 5 g Astorage device having the function of coping with a 
managed in the original information management file 34 c ter virus accor din g to claim 5, further comprising a 
with differential information brought about due to modin- fifst managmg ^ for managing original information of 
cation which is managed in the version upgrade information fileg stored on ' a second managing unit for man- 
management file 35 in order to produce a file, and by aging differential information brought about due to modifi- 
comparing the size of the produced file with the size of the io cation concern i n g the files stored on said disk and history 
file stored on the disk 30. information concerning the differential information brought 
As described so far, in several preferred embodiments of about due to modification, and a file registering unit for 
a storage device 1 having the function of coping with a merging original information of a file managed by said first 
computer virus in accordance with the present invention, managing unit with differential information brought about 
infection with a virus is prevented actively. The use of a file 15 due to modification concerning the file which is managed by 
infected with a virus is prohibited, and the file is restored said second managing unit so as to produce a hie, and tor 
automatically. Furthermore, information concerning infec- registering the produced file on said disk, 
tion with viruses is preserved so that it cannot be accessed 9. Astorage device having the * <2EE^ ! 
uun vvnu vuuow u f 1 computer virus according to claim 5, further comprising a 
read ly. Consequenfly, a storage devrce capable of properly ^™™ r ^ a file that is registered 
dealing with infection with a virus can be constructed. <* J* man g agement table ^ and ^ 

We claim: ^ concerning the file in an inexecutable area, and a 

1. Astorage device having me function of coping wrfh a for S reading Morma tion saved in said inexecut- 
computer virus, which has the abihty to deal with infection *«JBB that permission information for 
of a file stored on a disk with a virus, comprising: ^ ^ ^ ^ area fc giveiL 

an infection management table unit for registering virus ±Q Astora , £e device having tne function of coping with a 

infected files which are stored on said disk; computer virus according to claim 2, when a writing request 

a virus checker for detecting if a file stored on said disk j s ^sued f or an executable file stored on said disk, said table 

is infected with a vims, wherein the virus checker is registering unit judges that a file which is stored on said disk 

activated at intervals of a specific period or in response 3Q and is a source Q f the writing request is infected with a virus, 

to a command instruction; and registers the fact in said infection management table 

a table registering unit for registering a result of detection un j t 

from said virus checker in said infection management u Astorage device having the function of coping with a 

table unit; computer virus according to claim 2, wherein when the size 

a judging unit forjudging if a file is infected with a virus 35 of a file is varied by running the file, said table registering 

in response to an external use request externally made unit judges th at the file, said table registering unit judges that 

for a file stored on said disk by referencing said the file stored on said disk is infected with a virus, and 

infection management table unit; and registers the fact in said infection management table unit. 

a prohibiting unit for prohibiting use of the externally 12. Astorage device having the function of coping with a 

requested file when said judging unit judges that the 40 computer virus according to claim 2, wherein although a file 

externally requested file is infected with a virus. stored on said disk is judged to be an executable file in terms 

2. A storage device having the function of coping with a of the file name, if the file is declared to be a data file, said 
computer virus according to claim 1, wherein said virus table registering unit judges that the file stored on said disk 
checker is designed to be run by said storage device having is infected with a virus, and registers the fact in said 
the function of coping with a computer virus. 45 infection management table unit. 

3. A storage device having the function of coping with a 13. Astorage device having the function of coping with a 
computer virus according to claim 2, wherein said virus computer vims according to claim 2, further composing a 
checker is designed to be activated at intervals of a specific determining unit for determining through interactive pro- 
period, cessing whether the use of a virus-infected file that is 

4. A storage device having the function of coping with a 50 registered in said infection management table unit should be 
computer vims according to claim 2, wherein said vims permitted, wherein said prohibiting unit does not prohibit 
checker is designed to be activated in response to a com- the use of a file which is permitted by said determining unit, 
mand instruction. I 4 * A storage device having the function of coping with a 

5. A storage device having the function of coping with a computer virus according to claim 25, further comprising an 
computer virus according to claim 2, wherein when a writing 55 invalidating unit that when a writing request is issued for a 
request is issued for a system startup area stored on said disk, system startup area stored on said disk, invalidates the 
said table registering unit judges that a file which is stored writing request. 

on said disk and is a source of the writing request is infected 15. A storage device having the function of coping with a 

with a virus, and registers the fact in said infection man- computer virus according to claim 14, further comprising a 

agement table unit. 60 dedicated writing unit for executing writing for a system 

6. Astorage device having the function of coping with a startup area stored on said disk, wherein when a writing 
computer vims according to claim 5, further comprising an request is issued for the system startup area stored on said 
invalidating unit that when a writing request is issued for a disk, if the writing request specifies the use of said writing 
system startup area stored on said disk, invalidates the unit, said invalidating unit does not invalidate the writing 
writing request. 65 request. 

7. A storage device having the function of coping with a 16. Astorage device having the function of coping with a 
computer vims according to claim 5, further comprising a computer vims according to claim 2, further comprising a 



5,918,008 



25 



26 



first managing unit for managing original information of 
files stored on said disk, a second managing unit for man- 
aging differential information brought about due to modifi- 
cation concerning the files stored on said disk and history 
information concerning said differential information brought 
about due to modification, and file registering unit for 
merging the original information of a file managed by said 
first managing unit with the differential information brought 
about due to modification concerning the file which is 
managed by said second managing unit so as to produce a 
file, and for registering the produced file on said disk. 

17. A storage device having the function of coping with a 
computer virus according to claim 2, further comprising a 
saving unit for saving a virus-infected file that is registered 
in said infection management table unit and virus informa- 
tion concerning the file in an inexecutable area, and a 
reading unit for reading information saved in said inexecut- 
able area under the condition that permission information for 
permitting access to said inexecutable area is given. 

18. A storage device having the function of coping with a 
computer virus according to claim 26, further comprising a 
permitting unit for determining through interactive process- 
ing whether a writing request made for a file, which is 
registered as a virus-infected file by said table registering 
unit and is running, should be permitted. 

19. A storage device having the function of coping with a 
computer virus according to claim 18, wherein when a 
writing request is permitted by said permitting unit, if a file 
that is a destination of the writing request is rewritten, said 
table registering unit judges that the file which is stored on 
said disk and is the destination of the writing request is 
infected with a virus and registers the fact in said infection 
management table unit. 

20. A storage device having the function of coping with a 
computer virus according to claim 18, further comprising a 
determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 
registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
the use of a file which is permitted by said determining unit. 

21. A storage device having the function of coping with a 
computer virus according to claim 18, further comprising a 
first managing unit for managing original information of 
files stored on said disk, a second managing unit for man- 
aging differential information brought about due to modifi- 
cation concerning the files stored on said disk and history 
information concerning the differential information brought 
about due to modification, and a file registering unit for 
merging original information of a file managed by said first 
managing unit with differential information brought about 
due to modification concerning the file which is managed by 
said second managing unit so as to produce a file, and for 
registering the produced file on said disk. 

22. A storage device having the function of coping with a 
computer virus according to claim 18, further comprising a 
saving unit for saving a virus-infected file that is registered 
in said infection management table unit and virus informa- 
tion concerning the file in an inexecutable area, and a 
reading unit for reading information saved in said inexecut- 
able area under the condition that permission information for 
permitting access to said inexecutable area is given. 

23. A storage device having the function of coping with a 
computer virus according to claim 1, wherein said virus 
checker is designed to be activated at intervals of a specific 
period. 

24. A storage device having the function of coping with a 
computer virus according to claim 1, wherein said virus 
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checker is designed to be activated in response to a com- 
mand instruction. 

25. A storage device having the function of coping with a 
computer virus according to claim 1, wherein when a writing 
request is issued for a system startup area stored on said disk, 
said table registering unit judges that a file which is stored 
on said disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection man- 
agement table unit. 

26. A storage device having the function of coping with a 
computer virus according to claim 1, wherein when a writing 
request is issued for an executable file stored on said disk, 
said table registering unit judges that a file which is stored 
on said disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection man- 
agement table unit. 

27. Astorage device having the function of coping with a 
computer virus according to claim 1, wherein when the size 
of a file is vaned by running the file, said table registering 
unit judges that the file stored on said disk is infected with 
a virus, and registers the fact in said infection management 
table unit. 

28. Astorage device having the function of coping with a 
computer vinos according to claim 1, wherein although a file 
stored on said disk is judged to be an declared to be a data 
file, said table registering unit judges that the file stored on 
said disk is infected with a virus, and registers the fact in said 
infection management table unit. 

29. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising a 
determining unit for determining through interactive pro- 
cessing whether the use of a virus-infected file that is 
registered in said infection management table unit should be 
permitted, wherein said prohibiting unit does not prohibit 
the use of a file which is permitted by said determining unit. 

30. Astorage device having the function of coping with a 
computer vims according to claim 1, further comprising: 

a first man aging unit for managing original information of 

files stored on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registeiing the produced file on said disk, 
wherein said first managing unit manages original infor- 
mation that is confirmed not to be infected with a virus 
by said! virus checker, and said second managing unit 
manages differential information brought about due to 
modification which is confirmed not to be infected with 
a virus by said virus checker. 

31. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 

files stored on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
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differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein as for a file which is stored on said disk, of which 
original information is not registered in said first man- 
aging unit, and of which differential information 
brought about due to modification is not registered in 
said second managing unit, said table registering unit 
judges that the file stored on said disk is infected with 
a virus and registers the fact in said infection manage- 
ment table unit. 
32. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 
a first managing unit for managing original information of 

files stored on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein said first managing unit manages original infor- 
mation of said virus checker, and said second managing 
unit manages differential information brought about 
due to modification concerning said virus checker and 
history information concerning the differential infor- 
mation brought about due to modification. 

33. A storage device having the function of coping with a 
computer virus according to claim 32, wherein said gener- 
ating unit generates said virus checker at the time of running 
said virus checker. 

34. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages differential information brought 
about due to modification, further comprising a decod- 
ing unit for decoding encoded data managed by said 
first and second managing unit, and an encoding unit 
for executing inverse conversion that is inverse to 
conversion performed by said decoding unit. 

35. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
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stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a saving unit for saving a virus-infected file that is 
registered! in said infection management table unit and 
virus information concerning the file in an executable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 
inexecutable area is given. 

36. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the rile, and then registering the restored file 
on said (disk, 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages original information, and said 
second managing unit encodes and manages differen- 
tial information brought about due to modification, 
further comprising a decoding unit for decoding 
encoded data managed by said first and second man- 
aging umts, and an encoding unit for executing inverse 
conversion that is inverse to conversion performed by 
said deciding unit. 
37. A storage device having the function of coping with a 
computer virus according to claim 1, further comprising: 
a first managing unit for managing original information of 

files stored on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation (concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 
a restoring unit for deleting a virus- infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk; and 
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a saving unit for saving a virus-infected file that is 
registered in said infection management table unit and 
virus information concerning the file in an inexecutable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 5 
permission information for permitting access to said 
inexecutable area is given. 

38. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 

of a file stored on a disk with a virus, comprising: 10 
an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 15 
disk is infected with a virus, and for registering the 
result in said infection management table unit; 

& judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 2Q 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file, wherein when a writing request is issued for a 2 5 
system startup area stored on said disk, said table 
registering unit judges that a file which is stored on said 
disk and is a source of the writing request is infected 
with a virus, and registers the fact in said infection 
management table unit; and 30 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning a file which is managed by a second managing 
unit so as to produce a produced file, and for registering 35 
the produced file on said disk. 

39. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 40 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 
disk is infected with a virus, and for registering the 45 
result in said infection management table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 50 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; 

a saving unit for saving a virus-infected table unit and 55 
virus information concerning the file in an inexecutable 
area; 

a reading unit for reading information saved in said 
inexecutable area under the condition that permission 
information for permitting access to said inexecutable 60 
area is given; and 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning a file which is managed by a second managing 65 
unit so as to produce a produced file, and for registering 
the produced file on said disk. 
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40. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for receiving a result of detection 
from a virus checker for detecting if a file stored on said 
disk is infected with a virus, and for registering the 
result in said infection management table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a produced file, 
and for registering the produced file on said disk; 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk. 

41. A storage device, having the function of coping with 
a computer v irus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit used to manage files 
stored on said disk to see if the files are infected with 
viruses; 

a table registering unit for internally receiving a result of 
detection from a virus checker which internally detects 
that a file stored on said disk is infected with a virus, 
and for registering the result in said infection manage- 
ment table unit; 

a judging unit that, when a use request is made externally 
for a file stored on said disk, references said infection 
management table unit so as to judge if the file is 
infected with a virus; 

a prohibiting unit that, when said judging unit judges that 
a file is infected with a virus, prohibits the use of the 
file; and 

a file registering unit for merging original information of 
a file managed by a first managing unit with differential 
information brought about due to modification con- 
cerning, a file which is managed by a second managing 
unit so as to produce a produced file, and for registering 
the produced file on said disk. 

42. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising the steps 
of: 

managing files stored on said disk to see if the files are 
infected with viruses; 
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receiving a result of detection from a virus checker for 
detecting if a tile stored on said disk is infected with a 
vims; 

registering the result of detection; 

referencing said infection management table unit so as to 
judge if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 

prohibiting the use of the file when judging that a file is 
infected with a virus; 10 

judging that a stored file on said disk is a source of the use 
request infected with a virus and registering when the 
use request is issued for a system startup area stored on 
said disks; 

merging original information of a file managed by a first 15 
managing unit with differential information brought 
about due to modification concerning a file which is 
managed by a second managing unit so as to produce 
a produced file; and 
registering the produced file on said disk. 20 
43. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising the steps 

- 25 
of: 

managing files stored on said disk to see if the files are 

infected with viruses; 
receiving a result of detection from a virus checker for 

detecting if a file stored on said disk is infected with a 3Q 

virus; 

registering the result of detection; 

judging if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 

prohibiting use of the infected file when judging that a file 35 
is infected with a virus; 

saving a virus-infected table and virus information con- 
cerning the file in an inexecutable area; 

reading information saved in said inexecutable area under 4Q 
the condition that permission information for permit- 
ting access to said inexecutable area is given; 

merging original information of a file managed by a first 
managing unit with differential information brought 
about due to modification concerning a file which is 45 
managed by a second managing unit so as to produce 
a produced file; and 

registering the produced file on said disk. 

44. A method of storing a computer program on a com- 
puter storage device, having the function of coping with a 50 
computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising the steps 
of: 

managing files stored on said disk to see if the files are 
infected with viruses; 55 

receiving a result of detection from a virus checker for 
detecting if a file stored on said disk is infected with a 
virus; 

registering the result of detection; gQ 
judging if the file is infected with a virus when a use 
request is made externally for a file stored on said disk; 
prohibiting the use of the file when judging that a file is 

infected with a virus; 
managing original information of files stored on said disk; 6j 
managing differential information brought about by modi- 
fication concerning the files stored on said disk and 
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history information concerning said differential infor- 
mation brought about due to the modification; 
merging the original information of a file managed by said 
first managing unit with the differential information 
brought about due to modification concerning the file 
which is managed by said second managing unit so as 
to produce a produced file; 
registering the produced file on said disk; 
deleting a registered virus-infected file from said disk, 

thus restoring the file; and 
registering tthe restored file on said disk. 
45. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 

infected files which are stored on said disk; 
a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 
a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 
a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus, 
a first managing unit for managing original information of 

files stoired on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein said first managing unit manages original infor- 
mation that is confirmed not to be infected with a virus 
by said virus checker, and said second managing unit 
manages differential information brought about due to 
modification which is confirmed not to be infected with 
a virus by said virus checker, 
46. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 

infected files which are stored on said disk; 
a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 
a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging, unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 
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a prohibiting unit for piohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 
a first managing unit for managing original information of 

files stored on said disk; 5 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein as for a file which is stored on said disk, of which 
original information is not registered in said first man- 
aging unit, and of which differential information 20 
brought about due to modification is not registered in 
said second managing unit, said table registering unit 
judges that the file stored on said disk is infected with 
a virus and registers the fact in said infection manage- 
ment table unit. 25 
47. A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 

infected files which are stored on said disk; 30 
a virus checker for detecting if a file stored on said disk 
is infected with a vims, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 
a table registering unit for registering a result of detection 35 
from said virus checker in said infection management 
table unit; 

a judging unit forjudging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 40 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 50 
said differential information brought about due to 
modification; and 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 55 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 

wherein said first managing unit manages original infor- 
mation of said virus checker, and said second managing 60 
unit manages differential information brought about 
due to modification concerning said virus checker and 
history information concerning the differential infor- 
mation brought about due to modification. 

48. A storage device, having the function of coping with 65 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 
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an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said vims checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 
a prohibiting unit for prohibiting use of the externally 
requestedl file when said judging unit judges that the 
externally requested file is infected with a virus; 
a first managing unit for managing original information of 

files stored on said disk; 
a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored odi said disk and history information concerning 
said differential information brought about due to 
modification; and 
a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk, 
wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages differential information brought 
about due to modification, further comprising a decod- 
ing unit for decoding encoded data managed by said 
first and second managing unit, and an encoding unit 
for executing inverse conversion that is inverse to 
conversion performed by said decoding unit. 
49. A storage device, having the function of coping with 
a computer v irus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 

infected files which are stored on said disk; 
a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 
a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a iile stored on said disk by referencing said 
infection management table unit; 

a prohibiling unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
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differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; and 

a saving unit for saving a virus-infected file that is 5 
registered in said infection management table unit and 
virus information concerning the file in an executable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 10 
inexecutable area is given. 

50, A storage device, having the function of coping with 
a computer virus, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 15 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 2Q 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit forjudging if a file is infected with a virus 25 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 30 
externally requested tile is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 3 ~ 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modificatiou; 

a file registering unit foi merging the original information 40 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 45 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk, 50 

wherein said first managing unit encodes and manages 
original information, and said second managing unit 
encodes and manages original information, and said 
second managing unit encodes and manages differen- 
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tial information brought about due to modification, 
further comprising a decoding unit for decoding 
encoded data managed by said first and second man- 
aging unit, and an encoding unit for executing inverse 
conversion that is inverse to conversion performed by 
said decoding unit. 

51. A storage device, having the function of coping with 
a computer viru s, which has the ability to deal with infection 
of a file stored on a disk with a virus, comprising: 

an infection management table unit for registering virus 
infected files which are stored on said disk; 

a virus checker for detecting if a file stored on said disk 
is infected with a virus, wherein the virus checker is 
activated at intervals of a specific period or in response 
to a command instruction; 

a table registering unit for registering a result of detection 
from said virus checker in said infection management 
table unit; 

a judging unit for judging if a file is infected with a virus 
in response to an external use request externally made 
for a file stored on said disk by referencing said 
infection management table unit; 

a prohibiting unit for prohibiting use of the externally 
requested file when said judging unit judges that the 
externally requested file is infected with a virus; 

a first managing unit for managing original information of 
files stored on said disk; 

a second managing unit for managing differential infor- 
mation brought about modification concerning the files 
stored on said disk and history information concerning 
said differential information brought about due to 
modification; 

a file registering unit for merging the original information 
of a file managed by said first managing unit with the 
differential information brought about due to modifi- 
cation concerning the file which is managed by said 
second managing unit so as to produce a file, and for 
registering the produced file on said disk; 

a restoring unit for deleting a virus-infected file, which is 
registered in said infection management table unit, 
from said disk, activating said file registering unit, thus 
restoring the file, and then registering the restored file 
on said disk; and 

a saving unit for saving a virus-infected file that is 
registered in said infection management table unit and 
virus ini brmation concerning the file in an inexecutable 
area, and a reading unit for reading information saved 
in said inexecutable area under the condition that 
permission information for permitting access to said 
inexecutable area is given, 

# * # # * 
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52. A data processing system which has the ability to deal with infection of a file with 
a virus, the system comprising: 

a storage device storing files; 

a virus scanner detecting if a file sto red in said storage device is infected with a virus; 

and 

a saving unit saving a detected virus-infected file into a specific area within said storage 

device. 

53. A data processing system according to claim 52, further comprising a managing 
unit managing the detected virus-infected file that is saved in the specific area. 

54. A data processing system according to claim 53, further comprising a deleting 
unit deleting the detected virus-infected file. 

55. A data processing system according to claim 52, further comprising an encoder 
unit encrypting the detected virus-infected file. 

56. A data processing system according to claim 52, wherein the virus-inf ected file 
saved in the specific area is not able to run. 

57. A method for dealing with infection of a file by a virus, the method comprising: 
storing files; 

detecting if a stored file is infected with a virus; and 
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saving a detected virus-infected file into a specific area designated for virus-infected 

files. 



58. A method according to claim 57, further comprising managing the detected virus 
infected file that is saved in the specific area. 

59. A method according to claim 58, further comprising deleting the detected virus- 
infected file. 

60. A method a ccordin g to claim 57, further comprising enc r ypting the detected virus 
infected fil e that is saved in the specific area. 

61. A method according to claim 57, further comprising prohibiting the detected virus- 
infected file from executing. 

62. A computer readable storage controlling a computer to perform a method for 
dealing with infection of a file by a virus, by: 

detecting if a f ile stored in a storag e device is infected with a virus; and 

saving a detected virus-infected file into a specific area designated for virus-infected 

files. 



63. A computer readable storage according to claim 62, the method further 
comprising managing the detected virus-infected file that is saved in the specific area. 
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64. A computer readable storage according to claim 63, the method further 
comprising deleting the detected virus-infected file, 

65. A computer readable storage according to claim 62, the method further 
comprising encrypting the detected virus-infected file that is saved in the specific area. 

66. A computer readable storage ac cordin g to claim 62, the method further 
comprising prohibiting the detected virus-infected file from executing . 

67. An apparatus, comprising: 

a virus scanner scanning a file stored in a storage device for infection with a virus; and 
a quarantining device quarantining the file from non-infected files on the storage device, 
when the file is infected. 

68. An apparatus according to claim 67, wherein the storage device comprises at 
least one section dedicated to storing infected files. 

69. An apparatus according to claim 67, wherein the quarantining device requests a 
user's permission before performing the quarantining. 

70. An apparatus according to claim 67, further comprising an encrypting device 
encrypting the quarantined file. 
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71. An apparatus according to claim 67, wherein the file, when infected, is kept in a 
quarantine area on the storage device. 

72. An apparatus, comprising: 

a virus scanner scanning a file stored in a storage device for infection with a virus; and 
an encrypting device encrypting the file on the stora ge device, if the file is infected, 

73. An apparatus according to claim 72, wherein the file, when encrypted, cannot be 
executed because of its encrypted state. 

74. An apparatus according to claim 72, wherein th e encrypting device requests a 
user's permission before performing the encrypting. 

75. An apparatus comprising: 

a storage device storing a plurality of files and a status for each of the files indicating 
whether each of the files is infected with a virus; 

an input device inputting a selected file with infected status; and 

a quarantining device quarantining the selected file on the storage device. 

76. An apparatus according to claim 75, wherein the selected file, when quarantined, 
is unable to be executed. 

77. An apparatus according to claim 75, further comprising an e ncrypting device 
encrypting the selected file. 
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78. An apparatus according to claim 75, wherein the quarantining device keeps the 
selected file in a quarantine area on the storage device, 

79. An apparatus, comprising: 

a storage device storing a plurality of files and a status for each of the files indicating 
whether each of the files is infected with a virus; 

an input device inputting a selected file to be encrypted; and 
an encrypting device encrypting the selected file. 

80. An apparatus according to claim 79, wherein the selected file, when encrypted, is 
unable to be executed. 

81. A method, comprising: 

scanning a file for infection with a virus; and 
quarantining the file if infected with a virus. 

82. A method according to claim 81, further comprising requesting a users 
permission before performing the quarantining. 

83. A method according to claim 81 , wherein the file, when infected, is kept in a 
quarantine area in the storage device. 
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84. A method, comprising: 
scanning a file for infection with a virus; 

quarantining the file from non-infected files if the file is infected with a virus; and 
encrypting the file, when infected. 

85. A method, comprising: 

scanning a file for infection with a virus; and 
encrypting the file when infected with a virus, 

86. A method according to claim 85, wherein the file, wh en encrypted, cannot be 
executed because of its encrypted state. 

87. A method according to claim 85, further comprising requesting a users 
permission before performing the encrypting. 

88. A method, comprising: 

storing a plurality of files and a status for each of the files indicating whether each of the 
files is infected with a virus; 

inputting a selected file with infected status to be quarantined; and 
quarantining the selected file. 

89. A method according to claim 88, wherein the file, when quarantined, is unable to 
be executed. 
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90. A method according to claim 88, further comprising encrypting the selected file, 
when infected. 

91. A method according to claim 88, wherein the file , when quarantined, is kept in a 
quarantine area in a storage device. 

92. A method, comprising: 

storing a plurality of files and a status for each file indicating whether the file is infected 
with a virus; 

inputting a selected file to be encrypted; and 
encrypting the selected file. 

93. A method according to claim 92 t wherein the encrypted file is unable to be 
executed. 

94. A computer readable storage controlling a computer by: 
scanning a file for infection with a virus; and 

quarantining the file if infected with a virus, 

95. A computer readable storage according to claim 94, further comprising 
requesting a users permission before performing the quara ntining. 

96. A computer readable storage according to claim 94, wherein the file, when 
quarantined, is kept in a quarantine area in the storage device. 
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97. A computer readable storage controlling a computer by. 
scanning a file for infection with a virus; 

quarantining the file from non-infected files, when infected; and 
encrypting the file. 

98. A computer readable storage controlling a computer by: 
scanning a file for infection with a virus; and 

encrypting the file when infected with a virus. 

99. A computer readable storage according to claim 98, wherein the file, when 
encrypted, cannot be executed because of its encrypted state. 

100. A computer readable storage according to claim 98, further comprising 
requesting a users permission before performing the encrypting . 

101. A computer readable storage controlling a c omputer by: 

storing a plura lit y of files and a status for each of the files indicatin g whether each of the 
files is infected with a virus; 

inputting a selected file with infected status to be q uarantined; and 
quarantining the selected file. 

102. A computer readable storage according to claim 101 . wherein the selected file is 
unable to be executed. 
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103. A computer readable storage according to claim 101 , further comprising 
encrypting the selected file. 

104. A computer readable storage according to claim 101 , wherein the selected file is 
kept in a quarantine area in the storage device. 

105. A computer readable storage controlling a co mputer by: 

storing a plurality of files and a status for each of the files indicating whether each of the 
files is infected with a virus; 

inputting a selected file to be encrypted; and 
encrypting the selected file. 

106. A computer readable storage according to claim 105, wherein the selected file, 
after encryption, is unable to be executed. 

107. A computer readable data struc ture controll ing a co m puter, comprising: 
a list of files stored on a storage device; 

a virus status for each of the files indicating whether or not the file is virus infected; and 
a quarantine status for each of the files indicated whether or not the file is quarantined. 

108. A computer readable data structure controlling a computer comprising: 
a list of files stored on a storage device that are virus-infected; and 

a quarantine status for each of the files indicating whether or not the file is quarantined. 
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109. A method comprising: 

scanning a file for infection with a virus; and 

isolating the file from non-infected files, if the file is infected with a virus. 

110. An apparatus comprising: 

a virus scanner detecting if a file is infected with a virus; and 

a saving unit saving a detected virus-infected file into a separate storage area for virus 
infected files. 
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